DRF 权限

确定你能不能访问某个接口

DRF提供的权限方案

```
class AllowAny(BasePermission):
```
```
class IsAuthenticated(BasePermission):
```
```
class IsAdminUser(BasePermission):
```

class IsAuthenticatedOrReadOnly(BasePermission):

class DjangoModelPermissions(BasePermission):

class DjangoModelPermissionsOrAnonReadOnly(DjangoModelPermissions):

class DjangoObjectPermissions(DjangoModelPermissions):

自定义权限

只有VIP用户才能访问

自定义一个权限类

class MyPermission(BasePermission):
    message = '你不是VIP用户'

    def has_permission(self, request, view):
        # 在认证的时候获取到了用户，现在可以直接用
        if request.user and request.user.type == 2:
            return True
        else:
            return False

视图级别配置

class AuthorListView(ListCreateAPIView):
   queryset = models.Author.objects.all()
   serializer_class = AuthorModelSerializer
   authentication_classes = [MyAuth, ]
   permission_classes = [MyPermission, ]

全局级别配置

# 在settings.py中设置rest framework相关配置项
REST_FRAMEWORK = {
    "DEFAULT_AUTHENTICATION_CLASSES": ["auth_app.utils.MyAuth", ],
    "DEFAULT_PERMISSION_CLASSES": ["auth_app.utils.MyPermission", ]
}